Defense-in-Depth
for
AI Coding Assistant
Governance

flowchart TB
    subgraph USERS[1 - CODE ACCESS]
        DEV[Internal Developer]
        CON[External Contractor]
        ATK[Attacker with Stolen Code]
    end

    subgraph TOOLS[2 - AI TOOL SELECTION]
        AI-Providers
    end

    subgraph PROVIDER[3 - PROVIDER PROCESSING]
        RECEIVE[Receive Code Context]
        INDEX[Index Files]
        APICALL[Call Husn API]

        RECEIVE --> INDEX --> APICALL
    end

    subgraph HUSN[4 - HUSN CANARIES SERVICE]
        REGISTRY[(Pattern Registry)]
        MATCHER[Pattern Matching Engine]
        DECISION{Match Found?}

        REGISTRY --> MATCHER --> DECISION
    end

    subgraph ENFORCE[5 - POLICY ENFORCEMENT]
        NOTIFY[NOTIFY: Allow and Log]
        APPROVE[APPROVE: Wait for Authorization]
        BLOCK[BLOCK: Deny Access]
    end

    subgraph ORGRESPONSE[6 - ORGANIZATION RESPONSE]
        WEBHOOK[Webhook Notification]
        SIEM[SIEM / Slack / PagerDuty]
        INCIDENT[Incident Response Team]

        WEBHOOK --> SIEM --> INCIDENT
    end

    CLEAR[CLEAR: Proceed Normally]

    DEV --> AI-Providers
    CON --> AI-Providers
    ATK --> AI-Providers

    AI-Providers --> RECEIVE

    APICALL --> MATCHER

    DECISION -->|NO| CLEAR
    DECISION -->|YES| NOTIFY
    DECISION -->|YES| APPROVE
    DECISION -->|YES| BLOCK

    NOTIFY --> WEBHOOK
    APPROVE --> WEBHOOK
    BLOCK --> WEBHOOK

    CLEAR --> RETURN[Return to AI Provider]
    BLOCK --> DENY[Return Block to AI Provider]
            

flowchart TB
    subgraph USERS[1 - CODE ACCESS]
        DEV2[Internal Developer]
        CON2[External Contractor]
        ATK2[Attacker with Stolen Code]
    end

    subgraph TOOLS2[2 - AI TOOL SELECTION]
        AI-Providers2[AI-Providers]
    end

    subgraph AIPROVIDER[3 - AI PROVIDER INFRASTRUCTURE]
        subgraph ONPREM[On-Prem Husn Node]
            LOCALREG[(Local Pattern Cache)]
            LOCALMATCH[Local Matching Engine]
            LOCALDEC{Match Found?}

            LOCALREG --> LOCALMATCH --> LOCALDEC
        end

        RECEIVE2[Receive Code Context]
        INDEX2[Index Files]
        LOCALCHECK[Local Canary Check]

        RECEIVE2 --> INDEX2 --> LOCALCHECK
        LOCALCHECK --> LOCALMATCH
    end

    subgraph HUSNCLOUD[HUSN CLOUD - Pattern Sync]
        MASTERREG[(Master Pattern Registry)]
        SYNC[Periodic Sync Service]

        MASTERREG --> SYNC
    end

    subgraph ENFORCE2[4 - POLICY ENFORCEMENT]
        NOTIFY2[NOTIFY: Allow and Log]
        APPROVE2[APPROVE: Wait for Authorization]
        BLOCK2[BLOCK: Deny Access]
    end

    subgraph ORGRESPONSE2[5 - ORGANIZATION RESPONSE]
        WEBHOOK2[Webhook Notification]
        SIEM2[SIEM / Slack / PagerDuty]
        INCIDENT2[Incident Response Team]

        WEBHOOK2 --> SIEM2 --> INCIDENT2
    end

    CLEAR2[CLEAR: Proceed Normally]

    DEV2 --> AI-Providers2
    CON2 --> AI-Providers2
    ATK2 --> AI-Providers2

    AI-Providers2 --> RECEIVE2

    SYNC -.->|Encrypted Sync| LOCALREG

    LOCALDEC -->|NO| CLEAR2
    LOCALDEC -->|YES| NOTIFY2
    LOCALDEC -->|YES| APPROVE2
    LOCALDEC -->|YES| BLOCK2

    NOTIFY2 --> WEBHOOK2
    APPROVE2 --> WEBHOOK2
    BLOCK2 --> WEBHOOK2

    CLEAR2 --> RETURN2[Return to AI Provider]
    BLOCK2 --> DENY2[Return Block to AI Provider]